3 ms·
Is it protected against zip bombs and ../../ style pathname traversal?
by eurasiantiger 5y ago
Is it protected against zip bombs and ../../ style pathname traversal?
- stevekemp 5y agoMy first thought too. I created a simple directory: mkdir tmp/ cd tmp/ ln -s /etc/passwd index.html Then zipped that up, keeping the symlink: zip -r --symlinks tmp.zip tmp/ And it showed only the filename, rather than the server contents. I didn't explore further.